do not set CORS headers when request is not CORS

* * *

This commit was sponsored by local.ch, Switzerland's official
phonebook directory and kick-ass web & mobile development house.

They are a great place to work in Zurich and they want to hire you:

- Frontend Web Developer: http://go.hood.ie/local-ch-web-developer-gh
- Mobile Engineer: http://go.hood.ie/local-ch-mobile-web-engineer-gh